FBI remotely resets small Wi-Fi routers hacked by Russia

The FBI and Department of Justice on Tuesday began a court-authorized operation to reset settings on some Americans’ Wi-Fi routers affected by Russian hacking. The FBI also planned to collect information about Russian intelligence agents’ use of the routers, according to a news release from the Justice Department. The hacks affected TP-Link brand routers in small offices or home offices in 23 U.S. states. Some of the devices belonged to individuals working in the military, government, or other sectors, like healthcare, that are deemed critical by the U.S. government.

The commands the government developed to end Russian access to the routers had been tested and should not affect the devices’ normal function, according to the Justice Department. The FBI operation would not collect the information of legitimate users of the routers, the department said.

What did the Russian intelligence agents do? Russia’s Main Intelligence Directorate of the General Staff Military Unit 26165 was responsible for the hacks, according to the Justice Department. Beginning in at least 2024, agents stole credentials for thousands of TP-Link routers worldwide. They then hacked the routers to intercept some web searches and reroute them to Russian servers, according to the Justice Department. The agents used fake versions of services such as Microsoft Outlook Web Access to break into other devices on the same network as the compromised routers, and to harvest passwords, emails, and other sensitive information.

What actions did the government recommend for people whose routers may be compromised? The FBI said it would work to notify users of the affected routers. They could visit the TP-Link website to find information about proper router settings, and should also look through end-of-life product lists to see if their routers need to be replaced, according to the Justice Department.

All users of the small or home office routers could also factory reset routers, upgrade firmware, replace old servers, and make sure firewalls were in place, the department said.